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Abstract 


This document describes the KCipher-2 encryption algorithm. 
KCipher-2 is a stream cipher with a 128-bit key and a 128-bit 
initialization vector. Since the algorithm for KCipher-2 was 
published in 2007, security and efficiency have been rigorously 
evaluated through academic and industrial studies. As of the 
publication of this document, no security vulnerabilities have been 
found. KCipher-2 offers fast encryption and decryption by means of 
simple operations that enable efficient implementation.  KCipher-2 
has been used for industrial applications, especially for mobile 
health monitoring and diagnostic services in Japan. 
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Introduction 
KCipher-2 is a stream cipher that uses a 128-bit secret key anda 
128-bit initialization vector. Since the algorithm for KCipher-2 was 
published in 2007 [SASCO7], it has been evaluated in academic and 
industrial studies. The security and performance of KCipher-2 have 
been rigorously evaluated by its developers and other institutions 
[SECRYPTO7] [ICETEO7] [CRYPTEC] [SIIS11]. As of the publication of 
this document, no attack on KCipher-2 has been successful.  KCipher-2 


can be efficiently implemented in software to provide fast encryption 
and decryption, owing to its uncomplicated design. Only four simple 
operations are used: exclusive-OR, addition, shift, and table lookup. 
When the algorithm is implemented in hardware, internal computations 
can be parallel to yield greater efficiency. Moreover, since its 
internal state representation only amounts to several hundred bits, 
KCipher-2 is suitable for resource-limited environments.  KCipher-2 
has been actively used in several industrial applications in Japan, 
has been published by an international standardization body (ISO/IEC 
18033-4 [1S018033]), and has been designated a Japanese e-Government 
recommended cipher [CRYPTECLIST]. 


Algorithm Description 


In this section, we describe the internal components of KCipher-2 and 
define the operations for deriving key streams from an input key and 
an initialization vector. We illustrate the detailed operations, 
mostly in pseudocode format, but also provide code snippets written 
in the C language syntax when necessary. 


Kiyomoto & Shin Informational [Page 3] 


RFC 7008 A Description of KCipher-2 August 2013 


-1. Notations 


All values in this document are stored in big-endian order (aka 
network byte order). We use the following notations in the 
description of KCipher-2. 


Ё Bitwise exclusive-OR 

nim mth power of n 

+n Integer addition modulo 2#n 

<< rn n-bit left circular shift in an r-bit register 
Ох Hexadecimal representation 

E[i] The (i + 1)th element of E when E is composed of 


consecutive multiple elements 


GF Galois field. GF(n#m) means the finite field of exactly 
nim elements 


ios Multiplication of elements on the finite field СЕ (24132) 


NOTE: Many texts denote "the mth power of n" by "n^m", but we write 
it using "#”, instead of '^', to avoid reader confusion with the 
power operator and the XOR operator of the C language syntax. 


„2. Internal State 


The internal state of KCipher-2 can be denoted by S. The internal 
state consists of six sub-components: two feedback shift registers, 
FSR-A and FSR-B, and four internal registers, 11, Rl, 12, and R2. 
We, therefore, often write S = (А, В, Ll, В1, 12, R2), where A and В 
refer to FSR-A and FSR-B, respectively. 


.2.1. Feedback Shift Registers 


The two feedback shift registers (FSRs) are separately called 
Feedback Shift Register A (FSR-A) and Feedback Shift Register B 


(FSR-B). FSR-A is composed of five 32-bit units that are 
consecutively arranged. Each unit can be identified by A[0], A[1], 
A[2], A[3], and A[4]. Likewise, FSR-B is composed of eleven 
consecutive 32-bit units, B[0], ..., B[10]. All values stored in 


each 32-bit unit of FSR is in GF(2#32). 
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2.2.2. Internal Registers 


Besides FSR, KCipher-2 has four internal registers to store 
intermediate computation results during operation. The four 
registers are named L1, R1, L2, and R2. 


2.3. Operations 


Three major operations constitute the behavior of KCipher-2: init(), 

next(), and stream(). The init() operation initializes the internal 

values of the system. The next() operation derives new values of 5" 

from the values of S, where S' and S refer to the internal state. 

The stream() operation derives a key stream from the current state S. 


2.3.1. пехъ() 


The next() operation takes the current state S = (A, B, L1, R1, L2, 
R2) as input. The size of the input amounts to twenty of the 32-bit 
units in total (five units for A, eleven for B, and one for L1, R1, 
L2, and R2). It produces the next state S' = (A', В’, L1', RI’, 12’, 
R2'). This operation is mainly used to generate secure key streams 
by applying non-linear functions (NLFs) for every cycle of KCipher-2. 
Additionally, it is used to initialize the system. The behaviors are 
distinguished by the input parameter that indicates the operation 
modes. 


Inside the next() operation, the internal registers are updated by 
the result of the substitution function described in Section 2.4.2. 
The feedback shift registers are also updated by feedback functions. 
The feedback functions include the multiplication of register units 
and the fixed elements a0, al, a2, and a3 in a finite field. The 
fixed elements a0, ..., a3 are carefully chosen to provide the 
maximum length of the feedback shift registers. The theory behind 
the selection of fixed elements and the way to simplify the necessary 
multiplications are briefly described in Section 2.4.4. 


The operation takes the following inputs: 

o S = (A, B, 11, Rl, L2, R2) 

o mode = (INIT, NORMAL}, where INIT means the operation is used for 
initialization, and NORMAL means it is used for generating secure 


key streams. 


The operation outputs a new state, 
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by performing the following steps: 
1. Set registers in the nonlinear functions 


11” = sub K2 
R1’ sub_K2 
12" sub_K2 
R2' = sub K2 


R2 +32 B[4]); 
L2 +32 B[9]); 
L1); 
R1); 


anana 


for m from 0 to 3 
А' [m] = Аш + 1]; 


for m from 0 to 9 
в [m] = B[m + 1]; 


NOTE: sub_K2 is a substitution function described in 
Section 2.4.2. 


2. Depending on the value of the operation mode, do the following: 


а. When the mode is NORMAL, А" |4| and В" [10] are computed as 
follows: 


А" [4] = (a0 ** A[0]) ^ A[3]; 


if A[2] [30] is 1: 
if A[2][31] is 1: 


В [10] = (al ** B[O]) ^ BI1] ^ B[6] ^ (аз ** B[8]); 
else if A[2][31] is 0: 
В’ [10] = (al ** В[0]) ^ B[1] ^ BI6] ^ В[8]; 


else if A[2][30] is 0: 
if A[2][31] is 1: 


В [10] = (a2 ** В[0]) ^ BI1] ^ B[6] ^ (аз ** B[8]); 
else if A[2][31] is 0: 
B'[10] = (a2 ** B[0]) ^ В[1] ^ BI[6] ^ B[8]; 


b. When the mode is INIT, A'[4] and B'[10] are XOR-ed with the 
non-linear function output described in Section 2.4.1. 


A'[4] = (a0 ** А[0]) ^ A[3] ^ NLF(B[0], R2, R1, A[4]); 


if A[2][30] is 1: 
if A[2][31] is 1: 
B'[10] » (al ** B[0]) ^ B[1] ^ B[6] ^ (a3 ** B[8]) ^ 
NLF(B[10], L2, L1, A[0]); 
else if A[2][31] is 0: 
B'[10] = (al ** В[0]) ^ BLII ^ B[6] ^ BI8] ^ 
NLF(B[10], L2, 11, А[0]); 
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else if A[2][30] is 0: 
if A[2][31] is 1: 
B’ [10] = (a2 ** B[0]) ^ B[1] ^ B[6] ^ (аз ** B[8]) ^ 
NLF(B[10], L2, L1, A[0]); 
else if A[2][31] is 0: 
BY FLO] + (a2-** BION ^ BILI ^- 8161. ABTS] ^ 
NLF(B[10], L2, L1, A[0]); 


3. Output S' = (A', В", L1', R1’, 12", R2'). 


Note that A[2] is a 32-bit unit. Thus, A[2][j] is the value of the 
jth least significant bit of A[2], where 0 <= j <= 31. 


The corresponding code snippets written in the C language syntax can 
be found in Section 2.4.4 and Appendix B. 


2.3.2.  init() 


The init() operation takes a 128-bit key (K) and a 128-bit 
initialization vector (IV) and prepares the values of the state 
variables for generating key streams. 

o K = (K[0], K[1], K[2], K[3]), where each K[i] is a 32-bit unit and 
0 <= i <= 3 


A 


o IV + (1101, IV[1], IV[2], IV[3]), where each IV[i] is а 32-bit 
unit and 0 <= і <= 3, 


and the output is an initialized state S, which will be referenced as 


S(0). The output is derived from the following steps: 
1. Expand K to the 384-bit internal key IK = (IK[0], ..., IK[11]), 
where IK[i] is a 32-bit unit and 0 <= i <= 11. The expansion 


procedure is as follows: 


for m from 0 to 11 

if mis 0; 1, 25, or 3: 
IK[m] = K[m]; 

else if m is 5, 6, 7, 9, 10, or 11: 
ТК п] = IK[m - 4] ^ IK[m - 1]; 

else if m is 4: 
IK[4] = IK[0] ^ sub K2(IK[3] << 32 8) ^ 
(0x01, 0x00, 0x00, 0x00); 

else if m is 8: 
IK[8] - IK[4] ^ sub K2(IK[7] << 32 8) ^ 
(0x02, 0x00, 0x00, 0x00); 
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Section 2.4.2. 


2. Initialize the feedback shift registers and the internal 
registers using the values of IK and IV as follows: 


for m from 0 to 4 
A[m] = IK[4 - m]; 


B[0] = IK[10]; B[1] = IK[11]; B[2] 1101; B[3] 
B[4] = тк! 81; B[5] IK[9]; B[6] IV[2]1; B[7] 
B[8] = IK[7]; B[9] = IK[5]; B[10] = IK[6]; 


IV[1]; 
IV[3]; 


L1 R1 L2 R2 0x00000000; 
Set S as (A, B, L1, R1, L2, R2). 


3. Prepare the state values by applying the next() operation 24 
times as follows: 


for m from 1 to 24 
Set S' as next(S, INIT); 
Set Sas S'; 
4. Output S. 


2.3.3. stream() 


2013 


The stream() function derives a 64-bit key stream, Z, from the state 


values. Its input is an initialized state, 
о S = (A, B, L1, R1, L2, Е) 
and its output is Z = (ZH, ZL), where ZH and ZL are 32-bit units. 


stream() performs the following: 
1. Set register values 


ZH = NLF(B[10], L2, L1, A[0]); 
ZL = NLF(B[0], R2, R1, А[4]); 


2. Output Z = (ZH, ZL). 


NOTE: The function NLF is described in Section 2.4.1. 
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2.4. Subroutines 
We explain the functions used above: sub_K2(), NLF(), and S_box(). 
2.4.1. NLF() 


NLF() is a non-linear function that takes the four 32-bit values, A, 
B, C, D, and outputs the 32-bit value, Q. The output Q is calculated 
as follows. 


о: = (а, #328) ОЗ D; 
2.4.2. sub K2() 


sub K2() is a substitution function that is a permutation of 

СЕ (2432), based on components from the Advanced Encryption Standard 
(AES) [FIPS-AES]. Its input is a 32-bit value divided into four 
8-bit strings. Inside sub K2(), an 8-to-8-bit substitution function, 
S box(), is applied to each 8-bit string separately, and then a 32- 
to-32-bit linear permutation is applied to the whole 32-bit string. 
Our S box() function is identical to the S-Box operation of AES, and 
our linear permutation is identical to the AES Mix Column operation. 


Consider the input of sub K2 as a 32-bit value И = (w[3], w[2], м[ 1], 
w[0]), where each subelement of w is an 8-bit unit. Prepare two 
32-bit temporary storages, T = (t[3], t[2], t[1], t[0]) and Q = 


(4131, я!21, q[1], q[0]), where t[i] and q[i] are 8-bit units апа 0 
<= i <= 3. 


The 32-bit output Q is obtained from the following procedures: 


1. Apply S box() to each 8-bit input string. Note that S box() is 
defined in Section 2.4.3. 


for m from 0 to 3 
t[m] = S box(w[ml); 


2. Calculate а by the matrix multiplication, О = M * T in GF(2#8) of 
the irreducible polynomial f(x) = x#8 + x#4 + x#3 + x + 1, where 


о О is a 1x4 matrix, (4101, а[1], q[2], а!3)) 
о M is a 4x4 matrix, 

(02, 03, OT. 01, 

QT, 02, 03, 01, 


01, 01, 02, 03, 
03, 01, 01, 02) 
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о T is a 1x4 matrix, (t[0], t[1], t[2], t[3]). 


Namely, the procedure that calculates (q[3], 9121, q[1], q[0]) 
can be written in the C language syntax as: 


q[0] = GF mult by 2(t[0]) ^ GF mult by 3(t[1]) ^ t[2] ^ 1131; 
q[1] t[0] ^ GF mult by 2(t[1]) ^ GF mult by 3(t[2]) ^ t[3]; 
q[2] = t[0] ^ t[1] ^ СЕ mult by 2(t[2]) ^ GF mult by 3(4131); 
q[3] = GF mult by 3(t[0]) ^ t[1] ^ t[2] ^ GF mult by 2(t[31]); 


where GF mult by 2 and GF mult by 3 are multiplication functions 
in GF(248), defined as follows: 


o The function GF mult by 2(t) multiplies 2 by the given 8-bit 
value t in GF(248) and returns an 8-bit value а as follows (1а 
is a temporary 32-bit variable): 


lg =t << 1; 
if ((1а в 0x100) != 0) lq ^= 0x011B; 
а = lq ^ OxFF; 


o The function GF mult by 3(t) multiplies 3 by the given 8-bit 
value t in GF(248) and returns an 8-bit value а as follows (1а 
is a temporary 32-bit variable): 

Eq = (Е же) ^t 
if ((1а 4 0x100) != 0) lq ^= 0х0118; 
а = lq ^ OxFF; 

3. Output Q = (4131, q[2], а[1], qI01). 


2.4.3. S_box() 


S_box() is a substitution that can be done by a simple table lookup 
operation. Thus, S_box() can be defined by the following value 
table: 


S_box[256] = { 
0x63, 0х7с, 0x77, Ox7b, Oxf2, Ox6b, Ox6f, Oxc5, 
0x30, 0x01, 0x67, Ox2b, Oxfe, Oxd7, Oxab, 0x76, 
Oxca, 0x82, Oxc9, Ox7d, Oxfa, 0x59, 0x47, OxfO0, 
Oxad, Oxd4, Oxa2, Oxaf, Ох9с, Oxa4, 0x72, Охс0, 
Oxb7, Oxfd, 0x93, 0x26, 0x36, Ox3f, Oxf7, Охсс, 
0x34, Oxa5, Oxe5, Oxf1, 0x71, Oxd8, 0x31, 0x15, 
0x04, Oxc7, 0x23, Oxc3, 0x18, 0x96, 0x05, Охда, 
0x07, 0x12, 0x80, Oxe2, Oxeb, 0x27, Oxb2, 0x75, 
0x09, 0x83, Ox2c, Oxla, Oxlb, Охбе, Ox5a, О0ха0, 
0x52, Ox3b, Oxd6, Oxb3, 0x29, Oxe3, Ox2f, 0x84, 
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0x53, Oxd1, 0x00, Oxed, 0x20, Oxfc, ОхЬ1, Ox5b, 
Охба, Oxcb, Oxbe, 0x39, Ox4a, Ox4c, 0x58, Oxcf, 
OxdO, Oxef, Oxaa, Oxfb, 0x43, Ox4d, 0x33, 0x85, 
0x45, Oxf9, 0x02, Ox7f, 0x50, Ox3c, Ox9f, Oxa8, 
0x51, Oxa3, 0x40, Ox8f, 0x92, Ox9d, 0x38, Oxf5, 
Oxbc, Oxb6, Oxda, 0x21, 0x10, Oxff, Oxf3, Oxd2, 
Oxcd, 0x0c, 0x13, Охес, Ox5f, 0x97, 0x44, 0x17, 
0хс4, Оха7, Ox7e, Ox3d, 0x64, Ox5d, 0x19, 0x73, 
0x60, 0x81, Ox4f, Oxdc, 0x22, Ox2a, 0x90, 0x88, 
0x46, Охее, Oxb8, 0x14, Oxde, Ox5e, 0x0b, Oxdb, 
OxeO, 0x32, ОхЗа, 0x0a, 0x49, 0x06, 0x24, Ox5c, 
Oxc2, Oxd3, Oxac, 0x62, 0x91, 0x95, Oxe4, 0x79, 
Oxe7, Oxc8, 0x37, Ox6d, 0x8d, Oxd5, Ox4e, O0xa9, 
Ox6c, 0x56, Oxf4, Oxea, 0x65, Ox7a, Oxae, 0x08, 
Oxba, 0x78, 0x25, Ox2e, Oxlc, Охаб, Oxb4, Охсб, 
Oxe8, Oxdd, 0x74, Oxlf, Ox4b, Oxbd, Ox8b, Охва, 
0x70, Ox3e, Oxb5, 0x66, 0x48, 0x03, Oxf6, Ox0e, 
0x61, 0x35, 0x57, Oxb9, 0x86, Oxcl, Oxld, Охде, 
Oxel, Oxf8, 0x98, 0x11, 0x69, Oxd9, Ox8e, 0x94, 
Ox9b, Oxle, 0x87, Oxe9, Oxce, 0x55, 0x28, Oxdf, 
Ox8c, Oxal, 0x89, 0х0а, Oxbf, Oxe6, 0x42, 0x68, 
0x41, 0x99, Ox2d, OxOf, 0xb0, 0x54, Oxbb, 0x16 }; 


2.4.4. Multiplications in СЕ (2432) 


FSR-A and FSR-B are word-oriented linear feedback shift registers 
(LFSRs). In the next() operation of Section 2.3.1, the feedback 
functions to the two LFSRs are shown, which include multiplication of 
fixed elements a0, al, a2, or a3 in GF(2#32). The fixed elements are 
carefully chosen to maximize the period of the key stream generated 
by the two registers. Here, we briefly explain how we obtain the 
fixed elements. Further details and theories can be found in 
[SECRYPTO7]. 


We obtain a0 as follows. First, to guarantee that the period is 
maximized for an 8-bit unit, we consider p as the root of the 
primitive polynomial: 


x#8 + x#7 + x#6, + x + 1 in GF(2). 


Therefore, an 8-bit string y = (y7, ..., y0), where y7 is the most 
significant bit, can be written as: 


y = y7(p#7) + y6(pt6) + ... + у1(р) + yO 
Next, a0 is the root of irreducible polynomial of degree four: 


х#4 + р#24 (х#3) + p#3(x#2) + р#12(х) + p#71 in GF(2#8). 
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Then, hierarchically, a 32-bit unit Y = (Y3, Y2, У1, YO), where Y3 is 
the most significant byte, can be written as: 


УЗ (а0#3) + Y2(a042) + Y1(a0) + YO 
The feedback polynomial to FSR-A, 
f(x) = ай (х#5) + x#2 + 1 
produces the maximum-length period of the key stream with a0. 


Similarly, al, a2, and a3 are the roots of irreducible polynomials of 
degree four of 


х#4 + а#230 (х#3) + а#156(х#2) + а#93(х) + а#29 in GF (248) 
x#4 + г! 34 (х#3) + г#16(х#2) + г! 199(х) + r#248 in СЕ (2#8) 
x#4 + s#157(x#3) + s#253(x#2) + 5#56(х) + S#16 in СЕ (248) 


respectively. The feedback polynomial to FSR-B that uses al, a2, and 
a3 can produce the maximum-length period. The feedback polynomials 
to FSR-A and FSR-B are as written in Step 2 of the next() operation, 
and the mathematical notations of these polynomials can also be found 
in [SECRYPTO7]. 


Calculation of the original feedback polynomials might be time- 
consuming because it includes multiplications in finite fields. 
However, these multiplications can be done faster if the multiples of 
a0, ..., a3 were already calculated for all possible inputs. The 
tables of amulO, ..., amul3 in Appendix A provide such pre- 
calculation results. As shown in Step 2 of next(), we can utilize 
these tables to finish the necessary calculations efficiently. 


For example, consider the input as a 32-bit value w, which represents 
an element of GF(2#32). The 32-bit output string и" = a0 ** и can be 
obtained using the amulO table in Appendix A.1 as follows: 


м’ = (м << 8) ^ amulO[w >> 24]; 


Likewise, multiplications of (al ** w), (a2 ** w), and (a3 ** w) can 
be obtained in the same way, simply by using the amull, amul2, and 
amul3 tables that we provide in Appendixes A.2, A.3, and A.4. 


Eventually, Step 2 of the next() operation, which updates A'[4] and 
B'[10], can be written in the C language syntax as follows. Note 
that nA[4] and nB[10] correspond to A'[4] and B'[10], respectively, 
and templ and temp2 are 32-bit variables. 
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ПА [4] = ((A[0] << 8) ^ amulO[(A[0] >> 24)]) ^ A[3]; 
if (mode == INIT) 
nA[4] ^= NLF(B[0], R2, R1, A[4]); 


if (A[2] & 0x40000000) { 


templ = (В[0] << 8) ^ amull[(B[0] >> 24)1; 
| else | 
templ = (B[0] << 8) ^ amul2[(B[0] >> 24)1; 


} 


if (A[2] в 0х80000000) { 

temp2 = (B[8] << 8) ^ amul3[(B[8] >> 24)]; 
} else { 

temp2 = B[8]; 
} 


nB[10] = templ ^ B[1] ^ B[6] ^ temp2; 
if (mode == INIT) 
nB[10] ^= NLF(B[10], L2, L1, A[0]); 
2.5. Encryption and Decryption Scheme 
In this section, we use the notation S(i) to specifically reference 
the values of the internal state at i (where i >= 0), which is an 
arbitrary, discrete temporal moment (aka cycle) after the 
initialization. 
2.5.1. Key Stream Generation 


Given a 128-bit key К, a 128-bit initialization vector (IV), 
KCipher-2 is initialized as follows: 


S(0) = init(K, IV); 
where S(0) is а state representation. With an initialized state 
S(i), where i >= 0, a 64-bit key stream X(i) can be obtained using 
the stream() operation, as follows: 


X(i) + stream(S(i)); 


To generate a new key stream X(i + 1), use the next() operation and 
the stream() operation as follows: 


S(i + 1) = next(S(i), NORMAL); 
X(i + 1) = stream(S(i + 1)); 
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2.5.2. Encryption and Decryption of a Message 


Given a 64-bit message block M and a key stream X, an encrypted 
message E is obtained by 


Е= М ^Х; 
Conversely, the decrypted message D is obtained by 
D=E* х; 


The original message M and the decrypted message D are identical when 
the same key stream is used. 


3. Security Considerations 
We recommend reinitializing and rekeying after 2#58 cycles of 


KCipher-2, which means after generating 2464 key stream bits. It is 
important to make sure that no IV is ever reused under the same key. 
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Appendix A. Tables for Multiplication in СЕ (2#32) 
А.1. The table amulO 


amul0[256] = ( 
0x00000000,0xB6086D1A,0xAF10DA34,0x1918B72E, 
0x9D207768,0x2B281A72,0x3230AD5C, 0x8438C046, 
OxF940EEDO, Ox4F4883CA, 0x565034E4, OxEO5859FE, 
0x646099B8,0xD268F4A2,0xCB70438C, 0x 7D782E96, 
0x31801F63,0x87887279,0x9E90C557,0x2898A84D, 
OxACA0680B,0x1AA80511,0x03B0B23F, OxB5B8DF25, 
OxC8COF1B3,0x7EC89CA9,0x67D02B87,0xD1D8469D, 
0Ox55E086DB, OxE3E8EBCI, OxFAFO5CEF, Ox4CF831F5, 
0x62C33EC6, OxDACB53DC, 0xCDD3E4F2, Ox 7BDB89E8, 
OxFFE3 4 9AE, 0x49EB24B4, 0x50F3939A, OXE6FBFE80, 
0x9B83D016,0x2D8BBDOC, 0x34930A22, 0x829B6738, 
ОхОбАЗА 7 7Е, OXBOABCA64, 0xA9B37D4A, Ox1FBB1050, 
0x534321A5, OxE54B4CBF, OxFC53FB91, 0x4A5B968B, 
OxCE6356CD,0x786B3BD7,0x61738CF9,0xD77BE1E3, 
OxAA03CF75,0x1COBA26F,0x05131541,0xB31B785B, 
0x3723B81D,0x812BD507,0x98336229,0x2E3B0F33, 
0xC4457C4F,0x724D1155,0x6B55A67B, OxDD5DCB61, 
0x59650B27,0xEF6D663D, OxF675D113,0x407DBC09, 
0x3D05929F, Ox8BODFF85, 0x921548AB, 0x241D25B1, 
OxA025E5F7,0x162D88ED, 0x0F353FC3, OxB93D52D9, 
OxF5C5632C, 0x43CD0E36, 0x5AD5B918, OxECDDD402, 
0x68E51444,0xDEED795E, OxC7F5CE70,0x71FDA30A, 
0Ox0C858DFC, OxBA8DEOE6, 0xA39557C8,0x159D3AD2, 
0Ox91A5FA94,0x27AD978E, 0x3EB520A0, 0x88BDA4DBA, 
0xA6864289,0x108E2F93,0x099698BD, OxBF9EF5A7, 
0x3BA635E1, Ox8DAE58FB, 0x94B6EFD5, 0x22BE82CF, 
Ox5FC6AC59,0xE9CEC143,0xF0D6766D,0x46DE1B77, 
OxC2E6DB31,0x74EEB62B, 0x6DF60105, 0xDBFE6CIF, 
0x97065DEA, 0x210E30F0,0x381687DE, Ox8EL1EEACAÀ, 
0x0A262A82,0xBC2E4798,0xA536F0B6,0x133E9DAC, 
0x6E46B33A, OxD84EDE20, 0xC156690E, 0x775E0414, 
OxF366C452,0x456EA948,0x5C761E66,0xEA7E737C, 
Ox4B8AF89E, 0xFD829584,0xE49A22AA, 0х52924ЕВО, 
OxD6AA8FF6,0x60A2E2EC,0x79BA55C2,0xCFB238D8, 
OxB2CA164E,0x04C27B54,0x1DDACC7A,O0xABD2A1600, 
Ox2FEA6126,0x99E20C3C,0x80FABB12,0x36F2D608, 
Ox7AO0AET7FD,0xCC028AE7,0xD51A3DC9,0x631250D3, 
0xE72A9095,0x5122FD8F,0x483A4AA1,0xFE3227BB, 
0x834A0 92D, 0x35426437,0x2C5AD319,0x9A52BE03, 
Ox1E6A7E45,0xA862135F,0xB17AA471,0x0772C96B, 
0x2949C658, 0x9F41AB42, 0x86591C6C, 0x30517176, 
0xB469B130,0x0261DC2A,0x1B796B04,0xAD71061E, 
0xD0092888, 0x66014592, Ox7F19F2BC, 0xC9119FA6, 
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0x4D295FE0,0xFB2132FA, 0xE23985D4, 0x5431E8CE, 
0x18C9D93B, 0xAEC1B421,0xB7D9030F,0x01D16E15, 
0x85E9AE53,0x33E1C349,0x2AF97467,0x9CF1197D, 
O0xE18937EB,0x57815AF1,0x4E99EDDF,OxF89180C5, 
0x7CA94083,0xCAA12D99,0xD3B99AB7,0x65B1F7AD, 
Ox8FCF84D1,0x39C7E9CB, Ox20DF5EE5, 0x96D733FF, 
Ox12bEFF3B9,0xAA4E79EA3,0xBDFF298D,0x0BF74497, 
0x768F6A01,0xC087071B,0xD99FB035,0x6F97DD2F, 
OxEBAF1D69,0x5DA77073,0x44BFC75D,0xF2B7AA47, 
OxBEAF9BB2,0x0847F6A8,0x115F4186,0xA7572C9C, 
0x236FECDA, 0x956781C0,0x8C7F36EE, 0x3A775BF4, 
0x470F7562,0xF1071878,0xE81FAF56,0x5E17C24C, 
OxDA2F020A, 0x6C276F10, 0x753FD83E, 0xC337B524, 
OxEDOCBA17,0x5B04D70D,0x421C6023,0xF4140D39, 
Ox702CCD7F, 0xC624A065, 0xDF3C174B, 0x69347A51, 
0x144C54C7, 0xA24439DD, OxBB5C8EF3, OxOD54E3E9, 
0x896C23AF, 0x3F644EB5, 0x267CF99B, 0x90749481, 
OxDC8CA574, 0x6A84C86E, 0x739C7F40, 0xC594125A, 
Ох4 1АСО21С, 0xF7A4BF06, ОхЕЕВСО828, 0x58B46532, 
0x25CC4BA4, 0x93C42 6BE, 0x8ADC9190, ОхЗСО4ЕСВА, 
OxB8EC3CCC, ОхОЕЕ451р6, 0x1 7FCE6F8, OxA1F48BE2 }; 


A.2. The table amull 


amull1[256] = { 
0x00000000, 0xAO0F5FC2E, Ox6DC7D55C, 0xCD322972, 
0xDAA387B8,0x7A567B96, 0хВ76452Е4, 0x1791AECA, 
0x996B235D, 0x399EDF73, OxF4ACF601,0x54590A2F, 
0x43C8A4E5, 0xE33D58CB, Ox2EOF71B9,0x8EFA8D97, 
Ox1FD646BA, 0xBF23BA94, 0x721193E6, OxD2E46FC8, 
0xC575C102,0x65803D2C, 0xA8B2145E, 0x0847E870, 
0x86BD65E7,0x264899C9,0xEB7ABOBB, 0x4B8F4C95, 
Ox5C1EE25F, OxFCEB1E71, 0x31D93703,0x912CCB2D, 
0x3E818C59,0x9E747077,0x53465905,0xF3B3A52B, 
OxE4220BE1,0x44D7F7CF, 0x89E5DEBD, 0x29102293, 
OxA7EAAF04,0x071F532A,0xCA2D7A58,0x6AD88676, 
0x7D4928BC, OxDDBCD492, Ox108EFDEO, 0xBO7BO1CE, 
0x2157CAE3, 0x81A236CD, 0x4C901FBF, 0xEC65E391, 
OxFBF44D5B, 0x5B01B175, 0x96339807, 0x36C66429, 
OxB83CE9BE, 0x18C91590, OxD5FB3CE2, 0х750ЕСОСС, 
0x629F6E06,0xC26A9228,0x0F58BB5A, OxAFADA4774, 
0x7C2F35B2,0xDCDAC99C, Ox11E8EOEE, OxB11D1CCO, 
OxA68CB20A,0x06794E24,0xCB4B6756,0x6BBE9B78, 
OxE54416EF,0x45BlEACI1,0x8883C3B3,0x28763F9D, 
Ox3FE79157,0x9F126D79,0x5220440B,O0xF2D5B825, 
0x63F97308,0xC30C8F26, OxOE3EA654, ОхАЕСВБАТА, 
OxB95AF4B0, 0x19AF089E, 0xD49D21EC, 0x7468DDC2, 
OxFA925055,0x5A67AC7B, 0x97558509,0x37A07927, 
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0x2031D7ED, 0x80C42BC3, 0x4DF602B1, OXEDO3FE9F, 
Ох42АЕВ9ЕВ, OxE25B45C5, 0x2F696CB7, 0x8F9C9099, 
0x980D3E53, 0x38F8C27D, OxF5CAEBOF, 0x553F1721, 
OxDBC59AB6,0x7B306698,0xB6024FEA, 0x16F7B3C4, 
0x01661D0E,0xA193E120,0x6CA1C852,0xCC54347C, 
0x5D78FF51,0xFD8D037F, 0x30BF2A0D, 0x904AD623, 
0x87DB78E9,0x272E84C7,0xEAl1CADB5,0x4AE9519B, 
OxC413DC0C,0x64E62022,0xA9D40950,0x0921F57E, 
Ox1EBO5BB4, 0xBE45A79A, 0x73778EE8, 0xD38272C6, 
OxF85E6A49,0x58AB9667,0x9599BF15,0x356C433B, 
0x22FDEDF1,0x820811DF,0x4F3A38AD,O0xEFCFC483, 
0x61354914,0xC1C0B53A, 0x0CF29C48, 0xAC076066, 
OxBB96CEAC, 0x1B633282,0xD6511BF0, 0x76A4E7DE, 
0хЕ7882СЕЗ, 0х477ррорр, 0x8A4FF9AF, 0x2ABA0581, 
ОхЗОЗВАВАВ, 0x9DDE5765, 0x50EC7E17, 0xF0198239, 
Ox 7EE30FAE, 0xDE16F380, 0x1324DAF2,0xB3D126DC, 
0xA4408816, 0x04B57438, 0xC9875D4A, 0x6972A164, 
OxC6DFE610,0x662A1A3E,0xAB18334C,0xOBEDCF62, 
0x1C7C61A8, 0xBC899D86, 0x71BBB4F4, 0xD14E48DA, 
Ox5FBA4C54D, 0xFF413963,0x32731011,0x9286EC3F, 
0x851742F5,0x25E2BEDB, 0xE8D097A9,0x48256B87, 
OxD909A0AA, 0x79FC5C84, 0xB4CE75F6, 0x143B89D8, 
0x03AA2712,0xA35FDB3C,0x6E6DF24E, OxCE980E60, 
0x406283F7,0xE0977FD9,0x2DA556AB, 0x8D50AA85, 
0x9AC1044F,0x3A34F861,0xF706D113,0x57F32D3D, 
0x84715FFB,0x2484A3D5,0xE9B68AA7,0x49437689, 


0x5 
0х1 


D1A7CA6,0xBD 


ED2D843,0xFE27246D, 0x33150D1F,0x93E0F131, 


EF8088,0x70DDA9FA, 0xD02855D4, 


OxC7B9FB1E,0x674C0730,0xAA7E2E42,0x0A8BD26C, 
0x9BA71941, 0x3B52E56F, 0xF660CC1D, 0x56953033, 
0x41049EF9,0xE1F162D7,0x2CC34BA5,0x8C36B78B, 
0x02CC3A1C,0xA239C632,0x6FO0BEF40, OxCFFE136E, 
OxD86FBDA4,0x789A418A, 0xB5A868F8, 0x155D94D6, 
OxBAFOD3A2, 0x1A052F8C, 0xD73706FE, 0x77C2FADO, 
0x6053541A, 0xCOA6A834, 0x0D948146, ОхАО61 7068, 
Ox239BFOFF, 0х836Е0Ср1, 0x4E5C25A3, OxEEA9D98D, 
OxF 9387747, 0Ox59CD8B69, 0x94FFA21B, 0x340A5E35, 
0xA5269518,0x05D36936,0xC8E14044,0x6814BC6A, 
0x7F8512A0,0xDF70EE8E,0x1242C7FC, 0xB2B73BD2, 
Ox3CA4DB645,0x9CB84A6B, 0x518A6319, 0xF17F9F37, 


OxE6EE31FD, 0x461BCDD3, 0x8B29E4A1,0x2BDC188F }; 
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A.3. The table amul2 


amul2[256] = { 
0x00000000,0x5BF87F93, OXBOBDFE6B, OxED4581F8, 
0x2137B1D6, Ox7ACFCE45, 0x978A4FBD, 0xCC72302E, 
0x426E2FE1,0x19965072,0xF4D3D18A, OxAF2BAE19, 
0x63599EF37,0x38A1EF1A4, 0xD5E4605C, Ox8E1C1FCF, 
Ox84DC5E8F, 0xDF24211C, 0х3261А0Е4, 0x6999DF77, 
ОХАБЕВЕЕ 59, 0xFE1390CA, 0x13561132, Ox48AE6EAI1, 
0xC6B2716E, Ox9D4A0EFD, 0x700F8F05, Ox2BF7F096, 
OxE785COB8, 0xBC7DBF2B, 0x51383ED3, 0x0AC04140, 
0x45F5BC53, Ох1ЕООСЗСО, 0xF3484238, ОхАЗВОЗРАВ, 
0x64C20D85,0x3F3A7216,0xD27FF3EE, 0x89878C7D, 
0x079B93B2, 0x5C63EC21, 0xB1266DD9, OxEADE124A, 
0x26AC2264,0x7D545DF7,0x9011DCOF,O0xCBE9A39C, 
0xC129E2DC, 0x9AD19D4F, 0x77941CB7, 0x2C6C6324, 
OxE01E530A, 0xBBE62C99,0x56A3AD61,0x0D5BD2F2, 
0x8347CD3D, OxD8BFB2AE, 0x35FA3356, 0x6E024CC5, 
0xA2707CEB, 0xF9880378, 0x14CD8280, 0x4F35FD13, 
0x8AA735A6, 0xD15F4A35, 0x3C1ACBCD, 0x67E2B45E, 
0xAB908470, OxFO68FBE3, 0x1D2D7A1B, 0x46D50588, 
0xC8C91A47, 0x933165D4, 0x 7E74E42C, 0x258C9BBF, 
OxE9FEAB91,0xB206D402,0x5F4355FA, 0x04BB2A69, 
0x0E7B6B29,0x558314BA, 0xB8C69542, OXE33EEAD1, 
Ox2F4CDAFF, 0x74B4A56C, 0x99F12494,0xC2095B07, 
0x4C1544C8, 0x17ED3B5B, 0xFAA8BAA3, 0xA150C530, 
0x6D22F51E,0x36DA8A8D,0xDB9F0B75,0x806774E6, 
OxCF5289F5,0x94AAF666,0x79EF779E,0x2217080D, 
0xEE653823,0xB59D47B0,0x58D8C648,0x0320B9DB, 
0x8D3CA614,0xD6C4D987,0x3B81587F,0x607927EC, 
OxACOB17C2,0xF7F36851,0x1AB6E9A9,0x414E963A, 
Ox4B8ED77A, 0x1076A8E9, 0xFD332911,0xA6CB5682, 
Ox6AB966AC,0x3141193F,0xDC0498C7,0x87FCE754, 
OxO9EOF89B,0x52188708,0xBF5D06F0,0xE4A57963, 
0x28D7494D, 0x732F36DE, 0x9E6AB726, 0xC592C8B5, 
0x59036A01,0x02FB1592,0xEFBE946A, ОхВ44бЕВЕО, 
0x7834DBD7,0x23CCA444, OxCE8925BC, 0x95715A2F, 
0x1B6D45E0, 0x40953A73, OXADDOBB8B, 0xF628C418, 
0x3A5AF436,0x61A28BA5, 0x8CE70A5D, OxD71F75CE, 
OxDDDF348E, 0x86274B1D, 0x6B62CAE5, 0x309AB576, 
OxFCE88558,0xA710FACB,0x4A557B33,0x11AD04A0, 
Ox9FB11B6F, 0xC44964FC, 0x290CE504, 0x72F49A97, 
OxBE86AAB9,0xE57ED52A, 0x083B54D2, 0x53C32B41, 
Ox1CF6D652,0x470EA9C1, 0xAA4B2839, OxF1B357AA, 
0x3DC16784,0x66391817,0x8B7C99EF, OxD084E67C, 
0x5E98F9B3,0x05608620,0xE82507D8, 0xB3DD784B, 
Ox7FAF4865,0x245737F6, 0xC912B60E, 0x92EAC99D, 
0x982A88DD, OxC3D2F74E, 0x2E9776B6, 0x756F0925, 
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0xB91D390B, 0xE2E54698, 0x0FA0C760, 0x5458B8F3, 
0xDA44A73C, 0x81 BCD8AF, 0x6CF95957, 0x370126C4, 
OxFB7316EA, 0xA08B6979, 0Ox4DCEE881, 0x16369712, 
OxD3A45FA7, 0x885C2034, 0x6519A1CC, 0x3EE1DESF, 
OxF293EE71, 0xA96B91E2, 0x442E101A, Ox1FD66F89, 
0x91CA7046,0xCA320FD5,0x27778E2D,0x7C8FF1BE, 
OxBOFDC190,0xEB05BE03,0x06403FFB, Ox5DB84068, 
0x57780128,0x0C807EBB, OxE1C5FF43, 0xBA3D80D0, 
0x764FBOFE, Ox2DB7CF6D, OxCOF24E95,0x9B0A3106, 
0x15162EC9,0x4EEE515A, 0xA3ABDO0A2,0xF853AF31, 
0x34219F1F,0x6FD9E08C,0x829C6174,0xD9641EE7, 
0x9651E3F4,0xCDA99C67,0x20ECID9F,0x7B14620C, 
0xB7665222,0xEC9E2DB1,0x01DBAC49,0x5A23D3DA, 
OxD43FCC15, 0x8FC7B386, 0x6282327E, 0x397A4DED, 
OxF5087DC3, 0xAEF00250,0x43B583A8, 0x184DFC3B, 
0x128DBD7B, 0x4975C2E8,0xA4304310,0xFFC83C83, 
Ox33BAOCAD, 0x6842733E,0x8507F2C6,0xDEFF8D55, 
0x50E3929A, OxOB1BEDO9, OxE65E6CF1,0xBDA61362, 
0x71D4234C,0x2A2C5CDF,0xC769DD27,0x9C91A2B4 }; 


A.4. The table amul3 


amul3[256] = { 
0x00000000, 0x4559568B, 0x8AB2AC73, OxCFEBFAF8, 
0x71013DE6,0x34586B6D,0xFBB39195,0xBEEAC7I1E, 
0xE2027AA9,0xA75B2C22,0x68BO0D6DA, 0x2DE98051, 
0x9303474F,0xD65A11C4, 0x19B1EB3C, 0x5CE8BDB7, 
OxA104F437,0xE45DA2BC,0x2BB65844,0x6EEFOECF, 
OxD005C9D1,0x955C9F5A, 0x5AB765A2, Ox1FEE3329, 
0x43068E9E, 0x065FD815,0xC9B422ED, Ox8CED7466, 
0x3207B378, 0x775EE5F3, 0xB8B51F0B, 0xFDEC4980, 
0x27088D6E, 0x6251DBE5,0xADBA211D,O0xE8E37796, 
0x5609B088,0x1350E603, OxDCBBICFB, 0x99E24A70, 
0OxC50AF7C7,0x8053A14C,0x4FB85BB4,0xOAE10D3F, 
OxBAOBCA21, 0xF1529CAA, Ox3EB96652,0x7BE030D9, 
0x860C7959,0xC3552FD2, OxOCBED52A, 0x49E783A1, 
OxF70D44BF, 0xB2541234,0x7DBFE8CC, 0x38E6BE47, 
0x640E03F0,0x2157557B, OxEEBCAF83, OxABE5F908, 
0x150F3E16,0x5056689D, 0x9FBD9265, OxDAE4C4EE, 
Ox4E107FDC,0x0B492957,0xCA4A2D3AF, 0x81FB8524, 
0x3F11423A,0x7A4814B1,0xB5AS3EE49, 0xFOFAB8C2, 
0xAC120575,0xE94B53FE, 0x26A0A906,0x63F9FF8D, 
0xDD133893,0x984A6E18,0x57A194E0,0x12F8C26B, 
OxEF148BEB, 0xAA4DDD60, 0x65A62798, Ox20FF7113, 
0x9E15B60D, 0OxDB4CE086, 0x14A71A7E, Ox51FE4CF5, 
OxOD16F142,0x484FA7C9,0x87A45D31,0xC2FDOBBA, 
Ox7C17CCA4,0x394E9A2F,0xF6A560D7,0xB3FC365C, 
0x6918F2B2,0x2C41A439,0xE3AA5EC1,0xA6F3084A, 
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0x1819CF54, 0x5D4099DF, 0x92AB6327, 0хр7 
0x8B1A881B, 0xCE43DE90, 0x01A82468, 0x44F172E3, 
ОХЕА1 ВВ5ЕО, 0xBF42E376, 0x70A9198E, 0x35F04F05, 
0xC81C0685,0x8D45500E, 0x42AEAAF6, 0x07F7FC7D, 
0xB91D3B63,0xFC446DE8, 0x33AF9710,0x76F6C19B, 
Ox2A1E7C2C, 0x6F472AA7, OXAOACDOSF, OXESF586D4, 
Ox5B1F41CA, 0x1E461741,0xD1ADEDB9, 0x94F4BB32, 
0x9C20FEDD, 0xD979A856,0x169252AE, 0x53CB0425, 
OxED21C33B, 0xA87895B0, 0x67936F48, 0x22CA39C3, 
0x7E228474,0x3B7BD2FF,0xF4902807,0xB1 
0x0F23B992,0x4A7AEF19,0x859115E1,0xC0C84362A, 
0х3р240АЕА, 0x787D5C61,0xB796A699,0xF2CFF012, 
0x4C25370C,0x097C6187,0xC6979B7F, 0x83CECDF4, 
0xDF267043,0x9A"7F26C8,0x5594DC30,0x10CD8ABB, 
OxAE274DA5,0xEB7E1B2E,0x2495E1D6,0x61CCB75D, 
0xBB2873B3, 0xFE712538, ОхЗ1 ЗАПЕСО, 0x74C3894B, 
OxCA294E55,0x8F7018DE, 0x409BE226, 0x05C2B4AD, 
0х592А091А, 0x1C735F91, 0xD398A569, 0x96C1F3E2, 
0x282B34FC, 0x6D726277,0xA299988F, 0xE7COCEO4, 
0x1A2C8784,0x5F75D10F,0x909E2BF7,0xD5C77D7C, 
0x6B2DBA62,0x2E74ECE9,0xE19F1611,0xA4C6409A, 
OxF82EFD2D, OxBD77ABA6, 0x729C515E, 0x37C507D5, 
0x892FCOCB, 0xCC769640, 0x039D6CB8, 0x46C43A33, 
0xD2308101,0x9769D78A,0x58822D72,0x1D 
OxA331BCE7,0xE668EA6C,0x29831094,0x6C 
0x3032FBA8,0x756BAD23, 0xBA8057DB, OxFF 
0x4133C64E, 0x046A90C5, 0xCB816A3D, 0x8E 
0x73347536, 0x366D23BD, OxF986D945, 0xBC 
0x023548D0, 0x476C1E5B, 0x8887E4A3, 0xCDDEB228, 
0x91360F9F, 0xD46F5914, 0x1B84A3EC, Ox5EDDF567, 
0xE0373279,0xA56E64F2,0x6A859E0A, Ox2FDCC881, 
OxF5380C6F, 0xBO615AE4, 0x7F8AA01C, 0x3AD3F697, 
0x84393189,0xC1606702,0x0E8B9DFA, 0x4BD2CB71, 
0x173A76C6, 0x5263204D, 0x9D88DAB5, 0xD8D18C3E, 


0x663B4B20,0x2362 


ТРАВ, 0xEC89E753, 0xA9 


0x543CF858,0x1165AED3, 0xDE8E542B, 0x9B 


0x253DC5BE, 0x6064 
OxB63E82F1,0xF367 


9335,0xAF8F69CD, OxEA 
D47A, 0x3C8C2E82,0x79 


OxC73FBF17,0x8266E99C,0x4D8D1364,0x08 
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F235AC, 


С97ЕВС, 


DB7BF9, 
DA461F, 
D90150, 
D83CB6, 
DF8FCE, 


DOB1D8, 
D702A0, 
D63F46, 
D57809, 
D445EF }; 
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Appendix B. A Simple Implementation Example of KCipher-2 
We provide an example implementation of KCipher-2 written in C. The 
implementation is simple; we do not consider storage or time 
complexity, nor do we consider software engineering-related issues, 
such as encapsulation, modularity, and so on. 


B.1. Code Components I - Definitions and Declarations 


#include <stdio.h> 
#include <stdint.h> 


#define INIT 0 
#define NORMAL T 


void init (unsigned int *, unsigned int *); 
void next (int); 
void stream (unsigned int *, unsigned int *); 


static const uint8 t S box[256] = ( 


// as defined in Section 2.4.3 
}; 


static const 1114532 t amul0[256] = { 


// as defined in Appendix A.1 
}; 


static const 1116532 t amul1[256] = { 


// аз defined in Appendix A.2 
}; 


static const 1116532 t амо12 [256] = { 


// аз defined in Appendix A.3 
}; 


static const 1114532 t атми13 [256] = ( 


// аз defined in Appendix A.4 
}; 


/* Global variables */ 


// State 8 
uint32_t A[5]; // five 32-bit units 
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uint32_t В[11]; // eleven 32-bit units 
uint32 t Ll, Rl; L2;-R2; // one 32-bit unit for each 


// The internal key (IK) and the initialization vector (IV) 


uint32 t IK[12]; // (12*32) bits 
uint32 t IV[4]; // (4*32) bits 
B.2. Code Components II - Functions 
/** 
* Do multiplication in GF(2#8) of the irreducible polynomial, 
* f(x) = x48 + x#4 + x#3 + x + 1. The given parameter is multiplied 
* by 2. 
* (iparam Е : (INPUT). 8 bits. The number will be multiplied by 2 
* @return : (OUTPUT). 8 bits. The multiplication result 
*f 
uint8 t GF mult by 2 (uint8 t t) (4 
uint8 t а; 


uint32 1а; 


lg = t << 1; 
if ((1а & 0x100) != 0) lq ^= Ox011B; 
а = lq ^ OxFF; 


return q; 


} 


/** 
* Do multiplication in GF(2#8) of the irreducible polynomial, 
* f(x) = х#8 + x#4 + x#3 + x + 1. The given parameter is multiplied 
х ву: Bis 
* @param Е : (INPUT). 8 bits. The number will be multiplied by 3 
* @return : (OUTPUT). 8 bits. The multiplication result 
x 
uint8 t GF mult by 3 (uint8 t t) { 
uint8 а; 


uint32 1а; 

19 = (t««1) ^t; 

if ((1а в 0x100) != 0) lq ^= 0х0118; 
а = lq ^ OxFF; 


return q; 
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/** 
* Do substitution on a given input. 
* @param t (INPUT), (1*32) bits 
* (return (OUTPUT), (1*32) bits 
*/ 


uint32 t sub k2 
uint32 t out; 


м0 
wl 
w2 
w3 


uint8_t 
uint8_t 
uint8_t 
uint8_t 


uint8_t 
uint8_t 


t3, 
q3, 


t2, 
q2, 


ti, 
91, 


10 


S box[w0]; t1 


tO ^ ti 


out (q3 << 24) | 


return out; 


= GF_mult_by_2 (t0) 
tO ^ GF_mult_by_2 (t1) 
^ GF_mult_by_2 (t2) 
GF_mult_by_3 (t0) 


(uint32_t in) { 


in & 0x000000ff; 
(in >> 8) 
(in >> 16) 
(in >> 24) 


& 0x000000ff; 
& 0x000000ff; 
& 0x000000ff; 


t0; 
q0; 


S box[w1]; t2 


C tL t2 


(q2 «« 16) | 


^ GF mult by 3(t1) 
^ GF mult by 3(t2) 
^ GF mult by 3(t3); 
^ GF mult by 2(t3); 


(а1 << 8) 


August 2013 


See Section 2.4.2. 


t3 


S_box[w2]; = S box[w3]; 


Фра ds 


2433 


| а0; 


/** 

* Expand a given 128-bit key (K) to a 384-bit internal key 
* information (IK). 

* See Step 1 of init() in Section 2.3.2. 

* (iparam key [4] (INPUT), (4*32) bits 

* @param iv[4] (INPUT), (4*32) bits 

* @modify IK[12] (OUTPUT), (12*32) bits 

* @modify IV[12] (OUTPUT), (4*32) bits 

* 


/ 
void key expansion 
// copy iv to IV 


IV[0] = iv[0]; IV[1] = 1911; Iv[2] 
// m= 0 S03 
IK[0] - key[0]; IK[1] = key[1]; 
IK[2] = key[2]; IK[3] = key[3]; 
// m= 4 
IK[4] = IK[0] ^ sub k2((IK[3] << 8) ^ 
0x01000000; 
Kiyomoto & Shin Informational 


(uint32 t *key, 


uint32 t *iv) (4 


IV[3] аЗ: 


АЛ [Я] 


(IK[3] 


>> 24)) ^ 
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// ш = 4... 11, but not 4 nor 8 

IK[5] = IK[1] ^ IK[4]; IK[6] = IK[2] ^ IK[5]; 

IK[7] » IK[3] ^ IK[6]; 

// m= 8 

IK[8] = IK[4] ^ sub_k2((IK[7] << 8) ^ (IK[7] >> 24)) ^ 
0x02000000; 

// ш = 4... 11, but not 4 nor 8 


ІК[9] = IK[5] ^ IK[8]; IK[10] = IK[6] ^ IK[9]; 
IK[11] = IK[7] ^ IK[10]; 
} 


/** 

* Set up the initial state value using IK and IV. See Step 2 of 
* init() in Section 2.3.2. 

* @param key [4] : (INPUT), (4*32) bits 

* @param iv[4] (INPUT), (4*32) bits 

* @modify Ss (OUTPUT), (A, B, L1, Rl, 12, R2) 

*/ 


void setup state values (uint32 t *key, uint32 t *iv) { 
// setting up IK and IV by calling key expansion(key, iv) 
key expansion(key, iv); 


// setting up the internal state values 
A[0] = IK[4]; A[1] = IK[3]; A[2] = IK[2]; 
A[3] = IK[1]; A[4] IK[0]; 


B[0] = IK[10]; B[1] = IK[11]; B[2] IV[0]; B[3] = IV[1]; 
B[4] = IK[8]; B[5] = IK[9]; B[6] = IV[2]; B[7] = IV[3]; 
B[8] = IK[7]; B[9] = IK[5]; B[10] = IK[6]; 


11 R1 L2 R2 0x00000000; 


+ 


/** 

* Initialize the system with a 128-bit key (K) and a 128-bit 

* initialization vector (IV). It sets up the internal state value 

* and invokes next(INIT) iteratively 24 times. After this, 

* the system is ready to produce key streams. See Section 2.3.2. 

* @param key[12] : (INPUT), (4*32) bits 

* @param iv[4] (INPUT), (4*32) bits 

* @modify IK (12*32) bits, by calling setup state values() 

* @modify IV (4*32) bits, by calling setup state values() 
( 


@modify 5 OUTPUT), (А, B, L1, R1, L2, R2) 
*/ 

void init (uint32 t *k, uint32 t *iv) { 

int i; 
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for(i=0; i « 24; 
next (INIT); 
} 
} 
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iv); 


i++) { 


/** 

* Non-linear function. See Section 2.4.1. 
* (param A : (INPUT), 8 bits 

* Qparam B : (INPUT), 8 bits 

* @param C (INPUT), 8 bits 

* Qparam D (INPUT), 8 bits 

* @return (OUTPUT), 8 bits 

* 


/ 
uint32 t NLF 
uint32 t C, 
uint32 0; 
О = А + B) ^C 
return Q; 


} 
/** 


* Derive a new state from the current state values. 


* See Section 2.3.1. 


* (iparam mode (INPUT) INIT (+ 0) or NORMAL 
* Qmodify S (OUTPUT) 
*/ 
void next (int mode) (| 
uint32 t nA[5]; 
uint32 t nB[11]; 
uint32 t nL1, nR1, nL2, nR2; 
uint32 t templ, temp2; 
nL1 = sub k2(R2 + B[4]); 
nR1 = sub k2(L2 + B[9]); 
nL2 = sub к2 (11); 
nR2 = sub k2(R1); 
[AJ em ves 3 
nA[0] + A[1]; nA[1] + A[2]; nA[2] + A[3]; 
//m=0... 9 
nB[0] = B[1]; nB[1] = B[2]; nB[2] = B[3]; 
nB[4] = B[5]; nB[5] = B[6]; nB[6] = B[7]; 
nB[8] = B[9]; nB[9] = B[10]; 
Kiyomoto & Shin Informational 


(uint32_t A, 


uint32_t B, 
uint32 t D ) { 


^ Ту; 


August 2013 


(= 1) 

nA[3] = A[4]; 

nB[3] = B[4]; 

nB[7] = B[8]; 
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// update nA[4] 


templ = (А[0] << 8) ^ amulO[(A[0O] >> 24)]; 
nA[4] = templ ^ A[3]; 
if (mode == INIT) 


nA[4] ^= NLF(B[O], R2, R1, А[4]); 


// update nB[10] 


if (A[2] & 0x40000000) /* if A[21[30] == 1 */ 4 
templ = (В[0] << 8) ^ amull[(B[0] >> 24)]; 
| else /*if A[2][30] == 0*/ { 
templ = (B[0] << 8) ^ amul2[(B[0] >> 24)1; 
} 
if (A[2] & 0х80000000) /* if A[2][31] == 1 */ { 
temp2 = (B[8] << 8) ^ amul3[(B[8] >> 24)]; 
} else /* if A[2][31] == 0 */ { 


temp2 = B[8]; 
} 


nB[10] = templ ^ B[1] ^ B[6] ^ temp2; 


if (mode == INIT) 
nB[10] ^= NLF(B[10], L2, L1, A[0]); 


/* copy S' to S */ 
A[0] = nA[0]; A[1] » nA[1]; A[2] » nA[2]; 
A[3] + nA[3]; A[4] = nA[4]; 


B[0] = nB[0]; B[1] = nB[1]; B[2] nB[2]; B[3] nB[3]; 
B[4] = nB[4]; B[5] = nB[5]; B[6] = nB[6]; B[7] = nB[7]; 
B[8] - nB[8]; B[9] = nB[9]; B[10] = nB[10]; 


L1 + nL1; R1 = пв1; 12 = п12; R2 = пЕ2; 
} 


/** 

* Obtain a key stream - (ZH, ZL) from the current state values. 
* See Section 2.3.3. 

* (iparam ZH : (OUTPUT) (1 * 32)-bit 

* @modify ZL : (OUTPUT) (1 * 32)-bit 

ку 


void stream (uint32 t *ZH, uint32 t #21) { 
хан = NLF(B[10], L2, L1, А[0]); 
*ZL = NLF(B[0], R2, R1, A[4]); 
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B.3. Use Case 
void main (void) { 


// Set the key and the iv 
uint32_t key[4] = ...; 
uint32_t iv[4] = ...; 


init (key, iv); 


// produce a key stream 
stream(&zh, 621); 
next (NORMAL) ; 


// produce another key stream 
stream(&zh, 621); 
next (NORMAL) ; 


} 
Appendix C. Test Vectors 


This appendix provides running examples of KCipher-2 obtained from 
the naive implementation. All values are written in hexadecimal 
form. 


С.1. Key Stream Generation Examples 


The following is a series of the 64-bit key streams generated from 
the given 8-bit keys (К) and 128-bit initialization vectors (IVs). 


- К : 00000000 00000000 00000000 00000000 
- IV: 00000000 00000000 00000000 00000000 
- Generated key streams at S(i) are as follows 
5(0): F871EBEF 945B7272 
): E40C0494 1DFF0537 
): 0B981A59 FBC8AC57 
): 566D3B02 C179DBB4 
): 3B46F1F0 33554C72 
): SDE68BCC 9872858F 
): 57549602 4062F0E9 
): F932C998 226DB6BA 


- К : A37B7D01 2F897076 FEO8C22D 142BB2CF 

- IV: 33A6EE60 E57927E0 8B45CC4C A30EDE4A 

- Generated key streams at S(i) are as follows 
$(0): 60E9A6B6 7B4C2524 
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FE726D44 AD5B402E 
31DOD1BA 5CA233A4 
AFC74BE7 D6069D36 
4A75BB6C D8D5B7F0 
38AAAA28 A4AEACDA2F 
E2E5313D FC6CCD8F 
9D2484F2 OF86C50D 


о о о о о о о 
чо олом н 


— К : 3D62E9B1 8bE5B042F 42DF43CC 7175C96E 
- ТУ: 777CEFE4 541300C8 ADCACA8A 0848С055 
- Generated key streams at S(i) are as follows 
$(0): 690F108D 84F44AC7 
): BF257BD7 E394F6C9 
): AA1192C3 8E200C6E 
): 073C8078 AC18AAD1 
): DAB8DADE 68802368 
): 2FA42076 83DEA5A4 
) 4C1D95EA E959F5B4 
): 2611F41E A40F0A58 


С.2. Another Key Stream Generation with the State Values 
In this section, the initialization procedure and the key stream 
generation are illustrated in detail. The given 128-bit key (K) and 


the 128-bit initialization vector (IV) are as follows: 


- К : OFIE2D3C 4B5A6978 8796A5B4 C3D2E1F0 
- IV: FOEODOCO B0A09080 70605040 30201000. 


Based on K and IV, the init() operation (Section 2.3.2) sets up 
the internal state values, S = (A, B, Ll, Rl, L2, R2), as follows: 
A[0]: 7993A6A2 A[1]: C3D2E1F0 A[2]: 8796A5B4 


A[3]: 4B5A6978 A[4]: OF1E2D3C 


В[0]: 38AB371B B[1] : 4E26BC85 B[2]: FOEODOCO 
B[3]: BOA09080 B[4] : BF3D92AF B[5]: 8DF45D75 
B[6]: 70605040 B[7] : 30201000 B[8]: 768D8B9E 
B[9]: 32C9CFDA B[10]: B55F6A6E 


L1: 00000000 R1: 00000000 L2: 00000000 R2: 00000000 
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To complete the initialization, the next() operation is applied to 
the state values 24 times (in Section 2.3.2, Step 3). Let us denote 
each repeated application of the next() operation by init(i), where 1 
<= i <= 24. The internal state values resulting from each init (i) 
are shown in Appendixes C.2.1 - C.2.24. 


C.2.1. 5 after init(1) 


A[0]: C3D2E1F0 A[1]: 8796A5B4 A[2]: 4B5A6978 
A[3]: OF1E2D3C A[4]: 37070Е7Е 


B[0]: 4E26BC85 B[1] : FOEODOCO B[2]: BOA09080 


B[3]: BF3D92AF B[4] : 8DF45D75 B[5]: 70605040 
B[6]: 30201000 B[7] : 768D8B9E B[8]: 32C9CFDA 
B[9]: B55F6A6E B[10]: 64DEFF24 


L1: F360860C R1: E81907D5 L2: 63636363 R2: 63636363 
С.2.2. S after init(2) 


A[0]: 8796A5B4 A[1]: 4B5A6978 A[2]: OF1E2D3C 
A[3]: 37070F7F A[4]: 25BCF981 


B[0]: FOEODOCO B[1] : B0A09080 B[2]: BF3D92AF 
B[3]: 8DF45D75 B[4] : 70605040 B[5]: 30201000 
B[6]: 768D8B9E B[7] : 32C9CFDA B[8]: B55F6A6E 
B[9]: 64DEFF24 B[10]: 7E65CB6A 


L1: 1B9542ED R1: 9B259D28 L2: 971610F6 R2: 39C36E1D 
C.2.3. 5 after init (3) 


A[0]: 4B5A6978 A[1]: OF1E2D3C A[2]: 37070F7F 


A[3]: 25BCF981 A[4]: FA2DD9D3 

B[0]: B0AO9080 B[1] : BF3D92AF B[2]: 8DF45D75 
B[3]: 70605040 B[4] : 30201000 B[5]: 768D8B9E 
B[6]: 32C9CFDA B[7] : B55F6A6E B[8]: 64DEFF24 


B[9]: 7E65CB6A B[10]: 08573732 


L1: 1F41CDFB R1: СЕАЕТЗЕЗ L2: BCC7DC5B R2: 1528DDA1 


Kiyomoto & Shin Informational [Page 30] 


RFC 7008 A Description of KCipher-2 August 2013 


C.2.4. S after init (4) 


A[0]: OF1E2D3C A[1]: 37070F7F A[2]: 25BCF981 
A[3]: FA2DD9D3 A[4]: AB820031 


B[0]: BF3D92AF B[1] : 8DF45D75 B[2]: 70605040 
B[3]: 30201000 B[4] : 768D8B9E B[5]: 32C9CFDA 
B[6]: B55F6A6E B[7] : 64DEFF24 B[8]: 7E65CB6A 
B[9]: 08573732 B[10]: 40941D82 


11: 8D7100A7 R1: AA6C8F89 L2: B4F43081 R2: 81264AF3 
С.2.5. 5 after init(5) 


A[0]: 37070F7F A[1]: 25BCF981 A[2]: FA2DD9D3 
A[3]: AB820031 A[4]: D8F5995F 


B[0]: 8DF45D75 B[1] : 70605040 B[2]: 30201000 


B[3]: 768D8B9E B[4] : 32C9CFDA B[5]: B55F6A6E 
B[6]: 64DEFF24 B[7] : 7E65CB6A B[8]: 08573732 
B[9]: 40941082 B[10]: 1A8DA7FB 


L1: D315A91D R1: 751BC887 L2: 9E8539E3 R2: 929B1D3C 
C.2.6. S after init (6) 


A[0]: 25BCF981 A[1]: FA2DD9D3 A[2]: AB820031 
A[3]: D8F5995F A[4]: F697B5BB 


B[0]: 70605040 B[1] : 30201000 B[2]: 768D8B9E 


B[3]: 32C9CFDA B[4] : B55F6A6E B[5]: 64DEFF24 
B[6]: 7E65CB6A B[7] : 08573732 B[8]: 40941082 
B[9]: 1A8DA7FB B[10]: 13B5E7F3 


L1: 88658E94 R1: 7Е1С0230 L2: B16F9402 R2: 5FO06ABS3F 
C.2.7. 5 after init(7) 


A[0]: FA2DD9D3 A[1]: AB820031 A[2]: D8F5995F 
A[3]: F697B5BB A[4]: 680А7012 


B[0]: 30201000 B[1] : 768D8B9E B[2]: 32C9CFDA 


B[3]: B55F6A6E B[4] : 64DEFF24 B[5]: 7E65CB6A 
B[6]: 08573732 B[7] : 40941D82 B[8]: 1A8DAT7FB 
B[9]: 13B5E7F3 B[10]: D76ABD2C 


L1: 21BF8813 R1: 743F68DE L2: А1Е603Е6 R2: 3D1EA499 
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С.2.8. S after init (8) 


A[0]: AB820031 A[1]: D8F5995F A[2]: F697B5BB 
A[3]: 6B0A7012 A[4]: 23995B7E 
B[0]: 768D8B9E B[1] : 32C9CFDA B[2]: B55F6A6E 
B[3]: 64DEFF24 B[4] : 7E65CB6A B[5]: 08573732 
B[6]: 40941D82 B[7] : 1A8DA7FB B[8]: 13B5E7F3 
B[9]: D76ABD2C B[10]: 997C3F70 


11: B48EA08C R1: 657C8FFD L2: AAB50B58 R2: 281F9A12 
С.2.9. 5 after init(9) 


A[0]: D8F5995F A[1]: F697B5BB A[2]: 6BOA7012 
A[3]: 23995B7E A[4]: F8532F87 


B[0]: 32C9CFDA B[1] : B55F6A6E B[2]: 64DEFF24 
B[3]: 7E65CB6A B[4] : 08573732 B[5]: 40941082 
B[6]: 1A8DA7FB B[7] : 13B5E7F3 B[8]: D76ABD2C 
B[9]: 997C3F70 B[10]: 95FFF657 


L1: А2040С44 R1: EF19DC4E L2: 543A1967 R2: O05DOCF60 


C.2.10. S after init(10) 


A[0]: F697B5BB A[1]: 6B0A7012 A[2]: 23995B7E 
A[3]: F8532F87 A[4]: BEDF1DEF 
B[0]: B55F6A6E B[1] : 64DEFF24 B[2]: 7E65CB6A 
B[3]: 08573732 B[4] : 40941082 B[5]: 1A8DA7FB 
B[6]: 13B5E7F3 B[7] : D76ABD2C B[8]: 997C3F70 
B[9]: 95FFF657 B[10]: 6D2C2FA3 


L1: C7AE66B0 R1: 9C075DB9 L2: 5554CBE7 R2: 866080С4 


C.2.11. S after init(11) 


A[0]: 6B0A7012 A[1]: 23995B7E A[2]: F8532F87 
A[3]: BEDFIDEF A[4]: 983D37. 

B[0]: 64DEFF24 B[1] : 7E65CB6A B[2]: 08573732 
B[3]: 40941D82 B[4] : 1A8DA7FB B[5]: 13B5E7F3 
B[6]: D76ABD2C B[7] : 997C3F70 B[8]: 95FFF657 
B[9]: 6D2C2FA3 B[10]: A02127BE 


L1: 29F322A2 R1: 01F771D9 L2: 725670A2 R2: D4F24463 
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C.2.12. S- after init (12) 
A[0]: 23995B7E A[1]: F8532F87 A[2]: 
A[3]: 983D37CB A[4]: 526A110D 
B[0]: 7E65CB6A B[1] 08573732 B[2]: 
B[3]: 1A8DA7FB B[4] : 13B5E7F3 B[5]: 
B[6]: 997C3F70 B[7] : 95FFF657 B[8]: 
B[9]: A02127BE B[10]: 49F99042 
L1: 51536DF4 R1: 66111E6A L2: 8147B572 
C.2.13. S after init(13) 
A[0]: F8532F87 A[1]: BEDF1DEF A[2]: 
A[3]: 526A110D A[4]: АБЕЕВВАЕ 
B[0]: 08573732 B[1] 40941082 B[2]: 
B[3]: 13B5E7F3 B[4] : D76ABD2C В: 
B[6]: 95FFF657 B[7] : 6D2C2FA3 B[8]: 
B[9]: 49F99042 B[10]: 406CE62C 
L1: 95820912 R1: 6953AFE8 L2: B22A3A1D 
C.2.14. S after init(14) 
A[0] BEDF1DEF A[1]: 983D37CB A[2]: 
A[3] A5EEB8AE A[4]: 70A5B5BA 
B[0]: 40941082 B[1] 1A8DA7FB B[2]: 
B[3]: D76ABD2C B[4] : 997C3F70 B[5]: 
B[6] 6D2C2FA3 B[7] : A02127BE B[8]: 
B[9]: 406CE62C B[10]: C57BED5B 
L1: EB77DD2D R1: 633CFD8F L2: 32A4BCEF 
C.2.15. S after init(15) 
A[0]: 983D37CB A[1]: 526A110D A[2]: 
A[3]: 70A5B5BA A[4]: B1145F18 
B[0]: 1A8DA7FB B[1] 13B5E7F3 B[2]: 
B[3]: 997C3F70 B[4] : 95FFF657 B[5]: 
B[6]: A02127BE B[7] : 49F99042 B[8]: 
B[9]: C57BED5B B[10]: 7BE2C520 
L1: E11420CC R1: 6730A956 L2: 8EC8ACEF 
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BEDF1DEF 


40941D82 
D76ABD2C 
6D2C2FA3 


R2: 


983D37CB 


1A8DA7FB 
997C3F70 
A02127BE 


R2: 


526A110D 


13B5E7F3 
95ЕЕЕ 657 
49F99042 


6CC2AC80 


903A4823 


R2: 


CB33BCB2 


A5EEB8AE 


D76ABD2C 
6D2C2FA3 
406CE62C 


R2: 


C7FC060A 
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C.2.16. S after init (16) 
A[0]: 526A110D A[1]: АБЕЕВВАЕ A[2]: 
A[3]: B1145F18 A[4]: FA752FDC 
B[0]: 13B5E7F3 B[1] D76ABD2C B[2]: 
B[3]: 95FFF657 B[4] : 6D2C2FA3 B[5]: 
B[6]: 49F99042 B[7] : 406CE62C B[8]: 
B[9]: 7BE2C520 B[10]: 1F48829C 
L1: OD95C94D R1: 8238В05Е L2: 7B00D356 
C.2.17. S after init (17) 
A[0]: A5EEBS8AE A[1]: 70A5B5BA А121: 
A[3]: FA752FDC A[4]: DB29190A 
B[0]: D76ABD2C B[1] : 997C3F70 В[2 
B[3]: 6D2C2FA3 B[4] : A02127BE B[5]: 
B[6]: 406CE62C B[7] : C57BED5B B[8]: 
B[9]: 1F48829C B[10]: F95DD14F 
L1: 262687B5 R1: 9В9АС5Е9 L2: 7COS8EB5C 
С.2.18. 5 after init(18) 
A[0]: 70A5B5BA A[1]: B1145F18 A[2]: 
A[3]: DB29190A A[4]: 35623CDA 
B[0]: 997C3F70 B[1] 95FFF657 B[2]: 
B[3]: A02127BE B[4] : 49F99042 B[5]: 
B[6]: C57BED5B B[7] : 7BE2C520 B[8]: 
B[9]: F95DD14F B[10]: D939E13E 
L1: E478DEFO R1: 06F84503 L2: 71350E88 
С.2.19. 5 after init(19) 
A[0]: B1145F18 A[1]: FA752FDC A[2]: 
A[3]: 35623CDA А[4]: 74 6В4АЕВ 
B[0]: 95ЕЕЕ 657 B[1] 6D2C2FA3 B[2]: 
B[3]: 49F99042 B[4] : 406CE62C B[5]: 
B[6]: 7BE2C520 B[7] : 1F48829C B[8]: 
B[9]: D939E13E B[10]: 9970C980 
L1: С2АС94С4 R1: C708FAE8 L2: FC4900F1 
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70A5B5BA 


997СЗЕ 10 
A02127BE 
C57BED5B 


R2: 


B1145F18 


95FFF657 
49F99042 
7BE2C520 


R2: 


FA752FDC 


6D2C2FA3 
406CE62C 
1F48829C 


R2: 


DB29190A 


A02127BE 
C57BED5B 
F95DD14F 


R2: 
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OEFE8596 


8C1300A3 


14EF8E61 


7C260B6A 
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С.2.20. S after init (20) 
A[0]: FA752FDC A[1]: DB29190A A[2]: 
A[3]: 746B4AE8 A[4]: 2EB9213A 
B[0]: 6D2C2FA3 B[1] : A02127BE B[2]: 
B[3]: 406CE62C B[4] : C57BED5B B[5]: 
B[6]: 1F48829C B[7] : F95DD14F B[8]: 
B[9]: 9970C980 B[10]: 3C517031 
L1: 8F007DE9 Rl: B2AE0889 L2: DD68D5EA 
C.2.21. S after init (21) 
A[0]: DB29190A A[1]: 35623CDA A[2]: 
A[3]: 2EB9213A A[4]: BE3CA984 
В[0]: А02127ВЕ B[1] 49F99042 B[2]: 
B[3]: C57BED5B B[4] : 7BE2C520 Bois 
B[6]: F95DD14F B[7] : D939E13E B[8]: 
B[9]: 3C517031 B[10]: D1439B63 
L1: AFC4E32F R1: 98FBC87F L2: 58B22D36 
C.2.22. 5 after init (22) 
A[0]: 35623CDA A[1]: 746B4AE8 A[2]: 
A[3]: BE3CA984 A[4]: 974E6719 
B[0]: 49F99042 B[1] 406CE62C B[2]: 
B[3]: 7BE2C520 B[4] : 1F48829C B[5]: 
B[6]: D939E13E B[7] : 9970C980 B[8]: 
B[9]: D1439B63 B[10]: 9334E221 
L1: Е9С43357 R1: E5539EA2 L2: COB76A7C 
C.2.23. S after init (23) 
A[0]: 746B4AE8 A[1]: 2EB9213A A[2]: 
A[3]: 974E6719 A[4]: 86916EFF 
B[0]: 406CE62C B[1] C57BED5B B[2]: 
B[3]: 1F48829C B[4] : F95DD14F B[5]: 
B[6]: 9970C980 B[7] : 3C517031 B[8]: 
B[9]: 9334E221 B[10]: 50EF13E7 
L1: 309527ED R1: C473D814 L2: 1B107B6D 
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35623CDA 


49F99042 
7BE2C520 
D939E13E 


R2: 


74 6В4АЕВ 


406CE62C 
1F48829C 
9970C980 


R2: 


2EB9213A 


C57BED5B 
F95DD14F 
3C517031 


R2: 


BE3CA984 


7BE2C520 
D939E13E 
D1439B63 


R2: 
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3C8757AC 


481DC7D6 


O6EE4ED5 


0180D95D 
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C.2.24. 5(0) after 


A[0]: 
A[3]: 


B[0]: 
B[3]: 
B[6]: 
B[9]: 


1.1: 


Note that the result of init (24) 


2EB9213A 
8691 6EFF 


C57BED5B 
F95DD14F 
3C517031 
50EF13E7 


4370D8E6 


Section 2.3.2). 


Section 2.3.3) 
Key stream at S(0) 


Henceforth, 


A Description of KCipher-2 


init (24) 


ALL] 
A[4]: 


B[1] 

B[4] : 
B[7] : 
B[10]: 


R1: DABED76C 12: 


Since the state is 5(0), 
can be applied and generate key streams. 


August 2013 


BE3CA984 A[2]: 974E6719 
F52DACF9 

7BE2C520 B[2]: 1F48829C 

D939E13E B[5]: 9970C980 

D1439B63 B[8]: 9334E221 

EOBD9F91 

11C1ACCB R2: C3BAAEDF 
is also referred to as S(0) (in 
the stream() operation (in 


9FB6B580A6A5E7AF 


a new key stream can be produced by 1) ob 
state by applying the next () 


generating a new key stream by applying the stream() 
new state. 


C.2.25. 5(1) 


A[0]: 
A[3]: 


B[0]: 
B[3]: 
B[6]: 
B[9]: 


L1: 


Key stream at 5(1) 


BE3CA984 
F52DACF9 


7BE2C520 
D939E13E 
D1439B63 
EOBD9F91 


8FD86092 


Kiyomoto & Shin 


A[1]: 974E6719 A[2]: 
A[4]: 960329B5 
B[1] 1F48829C B[2]: 
B[4] 9970C980 B[5]: 
B[7] 9334E221 B[8]: 
B[10]: 5318AEE1 
R1: A4BBDCOF6 L2: 8D63A5EF 
D1989DC6A77D5E28 
Informational 


and the Key Stream at S(1) 


86916EFF 


F95DD14F 
3C517031 
50EF13E7 


taining a new 


operation to the current state, and 2) 


operation to the 


R2: FEEOF24B 
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C.2.26. 5(2) and the Key Stream at S(2) 


A[0]: 
A[3]: 


B[0]: 
B[3]: 
B[6]: 
B[9]: 


L1: 


Key 


9686FE8C R1: FAF89251 L2: 86C824E7 


stream at S(2) : 4EFCC8CB7BCFB32B 
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974E6719 A[1]: 86916EFF A[2]: F52DACF9 
960329B5 A[4]: 1A3DB24E 
1F48829C B[1] : F95DD14F B[2]: D939E13E 
9970C980 B[4] : 3C517031 B[5]: D1439B63 
9334E221 B[7] : 50EF13E7 B[8]: EOBD9F91 
5318AEE1 B[10]: C86C2C77 
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7BC21098 
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